Pwn chain: bug to working exploit

When it applies

You already know where it crashes — reverse-eng-binary-triage or exploit-memory-corruption found the overflow/UAF/double-free — and now you must produce a stable exploit against the real remote target, not a script that only works on your laptop. Covers userspace stack pwn, glibc heap exploitation, and Linux kernel/driver pwn (e.g. an ioctl bug for privesc). Pentest-only; note the crash risk in the RoE (tradecraft-scope-roe).

Why it works

A local win and a remote win differ by engineering, not by the bug: the remote libc version, ASLR slide, stack alignment, network buffering, and heap layout all shift. The chain is always the same — model the protections, leak what randomization hides, build the primitive (ROP/poisoned bin/sprayed object), then iterate against the real environment until the success rate is measured, not assumed.

Method

Stack / heap / kernel technique reference (templates, glibc version table, spray objects, privesc paths): see cheatsheet.md next to this file.